I think you can confirm from blockexplorer that MtGox didn't loose a large amount of bitcoins.
This seems to be their offline address: http://blockexplorer.com/address/1KLahQtqDNAXvrjNyfvgSBtAhwco5ZxLp4
There was a transfer at 18:17, at the time MtGox noticed the attack according to this timeline: http://blog.zorinaq.com/?e=55
There were no transactions in that address before that!
Some on this board claim the hacker sold and bought a large amount of coins at 0.01 to be able to withdraw 1000$ worth of coins at 0.01.
if any of these 400k were affected, this would show up on this address.
of course, noone knows how many coins were at MtGox above that 400k, but these 400k seem to be safe.
they were transferred to multiple other addresses at aprox 22:00 in 50k chunks and are now sitting there.
unless the hacker got hold of the private key of MtGox's offline deposit address, the large recorded transactions were MtGox's.
